KindaRails2Shell: Arbitrary File Read Leading to RCE in Rails Active Storage
Arbitrary file read vulnerability in Rails Active Storage via vips; patches available.
Active Storage's default vips variant processor exposes an arbitrary file read vulnerability that leads to RCE in stock Rails 7.x and 8.x applications, with no authentication required in some configurations. Only vips is affected, while Magick remains unaffected. The issue has been patched in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1, requiring libvips 8.13+ for the fix.